Topic 1 Flashcards
Timely, reliable access
Availability
Protection against unauthorized modification or destruction of information
Integrity
Disclosed to unauthorized persons
Confidentiality
Security measures to establish the validity of a transmission, message, or originator
Authentication
Data delivery and recipient
Non-repudiation
What are the 5 Information Assurance (A.I.C.A.N)
Availability, Integrity, Confidentiality, Authentication, and Non-repudiation
Tools and personnel used to defend an organization’s digital assets
Security
To protect the physical items
Physical Security
Individual or group of individuals
Personal Security
Series of activities
Operation Security
Organization’s communications media, technology, and content.
Communication Security
Networking components, connections, and contents.
Network Security
What are the 5 Securities? (P.P.O.C.N)
Physical Security, Personal Security, Operation Security, Communication Security, Network Security
Is the protection of information and its critical elements, including the systems and hardware that use, store, and transmit that information.
Information Security
What are the Three characteristics that described the utility of information?
Confidentiality, Integrity, and Availability
Enables users who need to access information to do so without interference or obstruction and in the required format.
Availability
Free from mistake or error
Accuracy
Reproduction or fabrication
Authenticity
Preventing disclosure or exposure
Confidentiality
Being whole
Integrity
End-user, it is not useful
Utility
Ownership or control of some object or item
Possession
What are the 7 Critical Characteristics of Information? (A.A.A.C.I.U.P)
Availability, Accuracy, Authenticity, Confidentiality, Integrity, Utility, and Possession
Entire set of software, hardware, data, people, procedures, and networks
Information System
Includes applications (programs), operating systems, and assorted command utilities
Software
Physical technology that houses and executes the software
Hardware
- Often the most asset
- Main target of intentional attacks
Data
- People have always been a threat to information security
- Social engineering
- Must be well trained and informed
People
- Procedures are written instructions for accomplishing a specific task.
- Threat to integrity of data
Procedures
- Locks and keys won’t work
Networks
What are the 6 components of Information System (IS) | (S.H.D.P.P.N)
Software, Hardware, Data, People, Procedures, and Networks
Grassroots effort
Bottom-up approach
- initiated by upper management
- Higher probability of success
- The project is initiated by upper-level managers
Top-down approach
A formal approach to solving a problem based on a structured sequence of procedures
Methodology
- A methodology for the design and implementation of an information system
The Systems Development Life Cycle
- The problem, objectives, constraints, and scope of the project are identified
- Begins with enterprise information security policy
Investigation
- consists primarily of assessments of the organization, its current systems, and its capability to support the proposed systems
- Existing security policies, legal issues,
- Perform risk analysis
Analysis
- Creates and develops blueprints for information security
- Incident response actions: Continuity planning, Incident response, Disaster recovery
- Feasibility analysis to determine whether project should continue or be outsourced
Logical Design
final design selected
Physical Design
- Security solutions are acquired, tested, implemented, and tested again
Implementation
- Most important
- Constant changing threats
- Constant monitoring, testing updating and implementing change
Maintenance and Change
What are the 6 SDLC Phases? (I.A.LD.PD.I.MC)
Investigation, Analysis, Logical Design, Physical Design, Implementation, Maintenance and Change.
- Senior technology officer is usually the chief information officer (CIO)
Senior Management
- Responsible for the assessment, management, and implementation of information security in the organization
- also be referred to as the manager for IT security, the security administrator, or by a similar title
- reports directly to the CIO
Chief information security officer (CISO)
